PT-2023-23114 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.0 through 16.0.5 GitLab EE versions 16.1 through 16.1.0 Description: A sensitive information leak issue has been discovered, allowing access to titles of private issues and merge requests. Recommendations: For GitLab EE...

Information Disclosure

mantisbt/mantisbt is vulnerable to Information Disclosure. The vulnerability allows any logged-in user to gain access to the Summary field of private issues if they are allowed to access group actions in the account which can lead to information disclosure...

CVE-2023-22476

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues i.e. having Private view status, or belonging to a private Proje...

CVE-2023-22476 MantisBT: Exposure of Private issues' summary to unauthorized users

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues i.e. having Private view status, or belonging to a private Proje...

PT-2023-18528 · Unknown · Mantis Bug Tracker

Name of the Vulnerable Software and Affected Versions: Mantis Bug Tracker versions prior to 2.25.6 Description: The issue is caused by insufficient access-level checks, allowing any logged-in user who can perform Group Actions to access the Summary field of private Issues via a crafted bug arr...

CVE-2023-22476: Exposure of Sensitive Information to an Unauthorized Actor

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the Summary field of private Issues i.e. having Private view status, or belonging to a private Proje...

Gitea allowed assignment of private issues

In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea there was no permission check for fetching the issue. As a result, the attacker would get access to private issue title...

Missing Authorization

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Missing Authorization via the bugactiongroup.php process. An attacker, with rights to create new issues, can clone any private issue, including all bugnotes and attachments, by manipulating the...

MantisBT Missing Authorization access check in bug_actiongroup.php

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

MantisBT Incorrect Authorization in bug_actiongroup_page.php

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

GHSA-PGG9-MMCG-8MXP MantisBT Incorrect Authorization in bug_actiongroup_page.php

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

GHSA-F38C-WXP6-8XJV MantisBT Missing Authorization access check in bug_actiongroup.php

An issue was discovered in MantisBT before 2.24.4. A missing access check in bugactiongroup.php allows an attacker with rights to create new issues to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue i.e., one having Private view status, or...

CVE-2020-29605

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

Improper access control

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

PT-2021-11700

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.24.4 Description: An issue was discovered due to insufficient access-level checks, allowing any logged-in user who can perform Group Actions to access the Summary fields of private Issues via bug arr in a crafted...

CVE-2020-29605: Incorrect Authorization

An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bugarr= in a crafted bugactiongrouppage.php URL. The target Issues can have Private view statu...

CVE-2020-36192

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues either marked as Private, or part of a private Project, if they are attached to an existing Changeset. The information is visible on the view.php...

Design/Logic Flaw

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues either marked as Private, or part of a private Project, if they are attached to an existing Changeset. The information is visible on the view.php...

CVE-2020-36192

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues either marked as Private, or part of a private Project, if they are attached to an existing Changeset. The information is visible on the view.php...

MantisBT Security Vulnerabilities

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. MantisBT before 2.4.1 A security vulnerability exists that can be exploited by attackers to gain access to...